Denial of Service in Oracle Java SE

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Oracle

Description

Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-70906

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	java_se	25.0.4
oracle	java_se	26.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Java SE versions 25.0.4 and 26.0.2 affecting the 2D component. It allows unauthenticated attackers to cause a denial of service (DOS) by exploiting network access via multiple protocols. The vulnerability can be triggered through APIs or web services supplying data to the 2D component, including Java Web Start or applets running untrusted code.

Impact Analysis

An attacker could exploit this to crash or hang your Java SE applications, leading to downtime or service disruption. Systems running affected Java versions are at risk, especially those processing untrusted data or exposed to network protocols.

Mitigation Strategies

Update Oracle Java SE to versions 25.0.5 or 26.0.3 or later to address the vulnerability. Disable Java Web Start applications and sandboxed Java applets if not required. Restrict network access to Java applications where possible.

Hi! I’m here to help you understand CVE-2026-70906. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70